State privacy enforcement intensifies in 2026 with aggressive testing of company data practices

In 2026, US state authorities have shifted towards assertive policing of privacy laws, scrutinising data collection and sharing practices more aggressively amid a rapidly evolving regulatory landscape.

State privacy enforcement has moved decisively from rule-making into active policing in 2026, with attorneys general and specialist agencies using both comprehensive privacy statutes and older consumer protection laws to test how companies collect, disclose and monetise personal information. The result is a far more uneven but also more forceful enforcement landscape, according to MultiState’s review of recent actions and industry tracking from the Future of Privacy Forum and law firms following state privacy developments.

The sharpest scrutiny has fallen on sensitive data, including health, financial, genetic, biometric and precise location information. Recent examples include a 42-state settlement with 23andMe over a 2023 breach affecting 6.9 million customers, Connecticut’s deal with TaxAct over tracking tools that allegedly transmitted taxpayer information to Meta and Google, Utah’s lawsuit against Hims & Hers Health over claims it shared private health data, and California’s settlement with GM over allegations that it sold location data to brokers without consent.

At the same time, state officials are increasingly relying on broad consumer-protection theories rather than privacy statutes alone. In one of the most significant examples, Meta agreed to an $18 billion settlement with 47 states over features such as infinite scroll, auto-play and push notifications that were said to promote compulsive use among children; the case also included allegations of unlawful collection of data from users under 13. New Mexico has separately won a major case against Meta under its unfair-practices law, and a court later imposed a further penalty over claims linked to youth harm and exploitation.

Texas has become another focal point for this approach. Attorney General Ken Paxton has pursued Netflix under the state’s deceptive trade practices law over allegations that the service tracked viewing behaviour, device data and other user information, including data from children’s profiles, while making conflicting claims about collection and sharing. He also settled with LG over accusations that television software gathered viewing data through automated content recognition without informed consent. The wider message is clear: companies may face exposure even in states without a dedicated children’s privacy statute if regulators believe their descriptions of data use are misleading or unfair.

California remains the most specialised enforcement arena. The state is still the only one with an agency devoted solely to privacy enforcement, and that agency has begun to use its powers more aggressively. It settled with Ford over claims that consumers faced unnecessary friction when trying to opt out, and it has now started issuing its first fines to data brokers that failed to register under the Delete Act. That action reinforces a broader point emerging across the states: privacy compliance is no longer just a paper exercise, but an operational risk that regulators increasingly expect companies to manage continuously.

The pressure is unlikely to ease. Venable’s mid-year update noted that Louisiana, Oklahoma, Alabama and Vermont have all passed new omnibus privacy laws that will take effect in 2027 or 2028, adding to an already fragmented regime. Other industry reviews say the number of states with comprehensive privacy laws has risen rapidly, and that contract terms, notice requirements, consumer rights processes and data-broker obligations are all becoming more exacting. For businesses, the practical challenge is not only understanding the patchwork, but anticipating where state regulators will next use it to push enforcement further.